From 28a3e326fad2451bdb66b747dd1f7ccbb900eed6 Mon Sep 17 00:00:00 2001 From: Pengpeng Hou Date: Tue, 30 Jun 2026 14:52:45 +0800 Subject: [PATCH] HID: rmi: check report length before trimming sentinel bytes rmi_check_sanity() trims trailing 0xff sentinel bytes, but its loop reads data[valid_size - 1] before checking that valid_size is non-zero. Reverse the condition so the length is proved before the last byte is inspected. Signed-off-by: Pengpeng Hou Signed-off-by: Jiri Kosina --- drivers/hid/hid-rmi.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/hid/hid-rmi.c b/drivers/hid/hid-rmi.c index d4af17fdba46..2bd781f1e0f5 100644 --- a/drivers/hid/hid-rmi.c +++ b/drivers/hid/hid-rmi.c @@ -365,7 +365,7 @@ static int rmi_check_sanity(struct hid_device *hdev, u8 *data, int size) * such reports here. */ - while ((data[valid_size - 1] == 0xff) && valid_size > 0) + while (valid_size > 0 && data[valid_size - 1] == 0xff) valid_size--; return valid_size;